The rash of attacks on social networking sites is continuing, this time in the form of a cross-site scripting worm that is currently plaguing
Reddit, the popular social bookmarking portal. The Reddit attack is interesting in that it requires a minimum of user interaction in order to spread.
The attack looks to be part of a spam campaign that was designed to submit a certain comment over and over again. Any user who copied a certain chunk of JavaScript code into the address bar of his browser would then find that he would automatically reply to all of the comments on a given page. A Reddit user then took this code and combined it with some other JavaScript code that had the effect of executing as soon as a user hovered his mouse over a specially designed link.
